CyberzSOC

The advisory published provides detailed information on various attack scenarios, exploitation pathways, descriptions of the fixes, and potential workarounds for those unable to immediately Multiple proof-of-concept (PoC) exploits for CVE-2024-23897 are now available [2]. The vulnerability CVE-2024-23897, with a CVSS score of 9.8, could allow an unauthenticated attacker with overall/read permission to read data from arbitrary files on the Jenkins server The vulnerability CVE-2024-23898, with a CVSS score of 8,8, is a cross-site WebSocket hijacking issue where attackers could execute arbitrary CLI commands by tricking a user into clicking The exploitation of these vulnerabilities could lead to admin privilege escalation and arbitrary remote code execution under certain conditions [1]. CERT-EU recommends immediate update of affected Jenkins versions to the latest patched versions.